Log in Start free

GFI

Products

ProductCVEsExploitedLatest
Archiver8–Feb 20, 2026
KerioConnect3–Mar 31, 2025
MailEssentials3–Apr 28, 2025
Kerio Control1–Jan 31, 2025

Exploited and recent CVEs

  • CVE-2026-2039 High 7.3 GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability 0.7%
  • CVE-2026-2036 High 8.8 GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability 1.4%
  • CVE-2026-2038 High 7.3 GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability 0.7%
  • CVE-2026-2037 High 8.8 GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability 1.4%
  • CVE-2025-35940 High 8.1 Hard-coded ArchiverSpaApi JWT Signing Key 0.4%
  • CVE-2025-34491 High 8.8 GFI MailEssentials < 21.8 MultiNode Insecure Deserialization 1.0%
  • CVE-2025-34490 Medium 6.5 GFI MailEssentials < 21.8 XXE Arbitrary File Read 0.7%
  • CVE-2025-34489 High 7.8 GFI MailEssentials < 21.8 Local Privilege Escalation 0.3%
  • CVE-2025-2977 Low 3.5 GFI KerioConnect PDF File cross site scripting 0.3%
  • CVE-2025-2976 Low 3.5 GFI KerioConnect File Upload cross site scripting 0.3%
  • CVE-2025-2975 Low 3.5 GFI KerioConnect Signature EditHtmlSource cross site scripting 0.3%
  • CVE-2024-52875 High 8.8 An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not 29.6%
  • CVE-2024-11949 High 8.8 GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.8%
  • CVE-2024-11948 Critical 9.8 GFI Archiver Telerik Web UI Remote Code Execution Vulnerability 1.4%
  • CVE-2024-11947 High 8.8 GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability 0.8%